Gui774ume / ebpfkit

ebpfkit is a rootkit powered by eBPF
Apache License 2.0
730 stars 85 forks source link

#7 i have tried lo, eth0, enp0s3 in my VMs' interface ,but it didn't work. #8

Open jackcily opened 2 years ago

jackcily commented 2 years ago

7 hello, i have tried lo, eth0, enp0s3 in my VMs' interface ,but it didn't work.

my host env config:

## host kernel version
Linux VirtualBox 5.4.0-110-generic #124-Ubuntu SMP Thu Apr 14 19:46:19 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux

## my kernel with  bpf compile config
$ cat /boot/config-$(uname -r) |grep bpf
CONFIG_CGROUP_BPF=y
CONFIG_BPF=y
CONFIG_BPF_SYSCALL=y
CONFIG_BPF_JIT_ALWAYS_ON=y
CONFIG_BPF_UNPRIV_DEFAULT_OFF=y
CONFIG_IPV6_SEG6_BPF=y
CONFIG_NETFILTER_XT_MATCH_BPF=m
CONFIG_BPFILTER=y
CONFIG_BPFILTER_UMH=m
CONFIG_NET_CLS_BPF=m
CONFIG_NET_ACT_BPF=m
CONFIG_BPF_JIT=y
CONFIG_BPF_STREAM_PARSER=y
CONFIG_LWTUNNEL_BPF=y
CONFIG_HAVE_EBPF_JIT=y
CONFIG_BPF_EVENTS=y
CONFIG_BPF_KPROBE_OVERRIDE=y
CONFIG_TEST_BPF=m

and that's my interfaces in host and docker i used.

enp0s3: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 10.0.2.15  netmask 255.255.255.0  broadcast 10.0.2.255
        inet6 fe80::1ad6:b997:5c8c:d269  prefixlen 64  scopeid 0x20<link>
        ether 08:00:27:ac:19:0b  txqueuelen 1000  (Ethernet)
        RX packets 15027  bytes 18707045 (18.7 MB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 8244  bytes 557794 (557.7 KB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

the command and error when i run ebpfkit as follows.

root@service:/data/ebpfkit/bin# ./ebpfkit -i enp0s3 -e enp0s3

Error: couldn't start: couldn't start main manager: couldn't start main manager: probes activation validation failed: 2 errors occurred:
        * {UID:egress Section:classifier/egress}: couldn't add a "clsact" qdisc to interface 2: netlink receive: no such file or directory
        * {UID:lo Section:classifier/egress}: couldn't add a "clsact" qdisc to interface 1: netlink receive: no such file or directory

Any helpful suggestions? Thanks : )

And can you tell me,which kernel version and bpf compile you used ?

brielino commented 1 year ago

Someone have fix the problem?

CodeforFunandPeace0x1337 commented 1 year ago

Hi, have you noticed the line CONFIG_NET_CLS_BPF=m - support for BPF based classifiers is compiled as a module. You can use lsmod | grep 'bpf_cls' to check if it is loaded. If not, use modprobe bpf_cls to load it :)

brielino commented 1 year ago

Hi, you mean cls_bpf? I try but the error is always the same

CodeforFunandPeace0x1337 commented 1 year ago

Yes, that's the one I meant. For me, this fixed a similar issue. However, I am also using a slightly different version

$ uname -a
Linux ubunu2004 5.4.0-26-generic #30-Ubuntu SMP Mon Apr 20 16:58:30 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux

You can get the image here

Also, can you manually create a qdisc sudo tc qdisc add dev enp0s3 clsact and attach a BPF program using the process described on the man-page?

brielino commented 1 year ago

I install your VM and install cls_bpf with command modprobe cls_bpf But always the same error, i have no idea why dont works

brielino commented 1 year ago

I resolve it! I need to execute manually sudo tc qdisc add dev enp0s3 clsact Thanks a lot